CTPRP Regulatory Requirements and Industry Standards for Third-Party Risk

Question 1

The OCC Bulletin 2013-29 (and its 2020 FAQ update) primarily governs third-party risk management for:

Accepted Answer

National banks and federal savings associations supervised by the Office of the Comptroller of the Currency

Answer

OCC Bulletin 2013-29 is the primary third-party risk management guidance for national banks and federal savings associations (OCC-regulated institutions). It establishes a risk management lifecycle — planning, due diligence, contract negotiation, ongoing monitoring, termination — and is a foundational regulatory reference in U.S. financial services TPRM.

Question 2

Under GDPR, when a company in the EU transfers personal data to a third-party vendor located outside the EU, which mechanism is commonly used to ensure adequate data protection?

Accepted Answer

Standard Contractual Clauses (SCCs) approved by the European Commission

Answer

Standard Contractual Clauses (SCCs) — pre-approved contract terms issued by the European Commission — are one of the primary legal mechanisms for transferring personal data from the EU to third parties in countries that lack an adequacy decision. They impose GDPR-equivalent obligations on the recipient vendor. Self-certifications and purchase orders do not satisfy this legal transfer requirement.

Question 3

The EU's Digital Operational Resilience Act (DORA), which became effective in January 2025, specifically requires financial entities to:

Accepted Answer

Manage ICT third-party risk, including contractual requirements for critical ICT providers and oversight of cloud vendors

Answer

DORA mandates that EU financial entities manage information and communications technology (ICT) third-party risk systematically. It requires specific contractual provisions with ICT vendors, concentration risk assessments for critical ICT providers, incident reporting obligations, and participation in the oversight framework for designated Critical ICT Third-Party Providers (CTPPs).

Question 4

The Shared Assessments Standardized Information Gathering (SIG) questionnaire is designed to:

Accepted Answer

Provide a common, comprehensive tool for assessing vendor information security and privacy controls across multiple domains

Answer

The SIG is a standardized questionnaire maintained by Shared Assessments (the body that administers the CTPRP credential) that covers 19+ control areas including cybersecurity, privacy, BC/DR, and physical security. It is designed to reduce duplicative assessment efforts for vendors by providing a common framework, but it does not replace regulatory assessments, provide certification, or serve as a legal contract.

Question 5

Under the FFIEC IT Examination Handbook guidance on third-party relationships, which of the following is considered a 'critical activity' requiring enhanced oversight?

Accepted Answer

Core banking system processing outsourced to a third-party service provider

Answer

The FFIEC guidance defines 'critical activities' as those significant to the financial institution's financial condition, operations, or customer data. Core banking system processing — which handles transactions, accounts, and sensitive financial data — is the archetypal example. Janitorial, printing, and catering services do not involve critical financial operations or sensitive data.

(CTPRP) Certified Third Party Risk Professional Practice Test

(CTPRP) Certified Third Party Risk Professional Practice Test

CTPRP Regulatory Requirements and Industry Standards for Third-Party Risk